Re: [PATCH] update raw patch in POM

[Pablo Neira <pablo@eurodev.net>]

Thomas Graf wrote:
> * Patrick McHardy <42B8B181.4020607@trash.net> 2005-06-22 02:32
> 
>>Thomas Graf wrote:'
>>
>>>This patch seems fine but it cannot fix the bug. The fact that we
>>>trigger the BUG() implies a serious problem which is that we'd be
>>>calling destroy() on a conntrack entry which was never allocated.
>>
>>Sorry, I didn't follow the entire thread and there seem to be a lot
>>of BUG()s :) Which one exactly are you refering to?
> 
> 
> Roberto added the following to nf_conntrack_put():
> 
> if ((((long) nfct) & 0xf8000000) && atomic_read(&nfct->master->use) <= 1)
>         BUG();

I don't consider reliable such BUG() triggered since I see this as a 
tricky race condition. AFAICS, the skbuff still enqueued holds a pointer 
to an invalid address that doesn't store ip_conntrack_untracked anymore, 
instead it points to something different, say the .bss section of 
another module reloaded which isn't the ip_conntrack module. Roberto's 
recipe requires module removal and reload in a very short space of time 
and I can't assure that those modules are installed and removed in the 
same order.

--
Pablo